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Abstract 

o i 

The discrete logarithm problem asks to solve for the exponent x, given the generator g of a 
CD ' cyclic group G and an element h 6 G such that g x — h. We give the first rigorous proof that 

[ Pollard's Kangaroo method finds the discrete logarithm in expected time (3 + o(l))y/b — » when 

the logarithm x G [a, b], and (2 + o(l))^b — a when x (z U ar [a, b]. This matches the conjectured 
time complexity and, rare among the analysis of algorithms based on Markov chains, even the 
_"H lead constants 2 and 3 are correct. 

Oh 

■ Keywords: Pollard's Kangaroo method, digital signature, discrete logarithm, Markov chain, 

mixing time. 

1 Introduction 

t-H ■ 

Cryptographic schemes are generally constructed in such a way that breaking them will likely 
require solving some presumably difficult computational problem, such as finding prime factors or 
solving a discrete logarithm problem. Recall that the discrete logarithm problem asks to solve for 
the exponent x, given the generator g of a cyclic group G and an element h £ G such that g x = h. 
The DifHe-Hellman key exchange, ElGamal cryptosystem, and the US government's DSA (Digital 
qq ' Signature Algorithm) are all based on an assumption that discrete logarithm is difficult to find. A 

Birthday Attack is a common approach towards solving these problems, and although heuristics 
J> , can be given for the time complexity of these methods, rigorous results are rare. 

ITj | In [3] we examined one such method, namely Pollard's Rho Algorithm to find the discrete log- 

arithm on a cyclic group G, and verified the correctness of commonly held intuition. This work 



o 



generated further interest among some of the experts in cryptography, and Dan Boneh pQ in par- 
ticular encouraged us to analyze Pollard's Kangaroo method [5], due to its very many applications. 
When the discrete logarithm x is known to lie in a small interval [a, b] with b — a <C \G\, this 
algorithm is expected to improve on the Rho algorithm, with a run time averaging 2\/b — a steps, 
versus \J (7r/2)|G| for the Rho algorithm. In fact, for some cyclic groups the Kangaroo method is 
the most efficient means known for finding discrete logarithm over an interval, as Shanks baby-step 
giant-step method requires too much memory. 

Among the cases in which this would be useful, Boneh and Boyen [2] give a signature scheme in 
which a shorter signature can be transmitted if the receiver uses the Kangaroo method to determine 
the missing information. Verification of the time complexity of the Kangaroo method (as we do 
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here) would then make rigorous their claim that the missing bits can be efficiently constructed. 
While the above is an application for signature communication, another natural application is in 
forging a signature. For instance, in order to speed up computation of a signature the secret key 
x may be chosen from an interval [a, b] with b — a <C \G\, or an attack might reveal a sequence of 
consecutive bits at the beginning or end of the key, in which cases the Kangaroo method can be 
used to find the key and forge a signature. 

The Kangaroo method is based on running two independent sequences of hops (random walks), 
one starting at a known state (the "tame kangaroo" ) and the other starting at the unknown value 
of the discrete logarithm x (the "wild kangaroo" ) . The main result of this paper will be a bound 
on the expected number of steps required by the kangaroos before the logarithm is determined. In 
particular, we find that for the Distinguished Points implementation of the Kangaroo method, 

Theorem 1.1. Suppose g,h £ G are such that h = g x for some x 6 [a, b]. The expected number of 
group operations required by the Kangaroo method is 

(3 + o(l))\/6-a. 

If x £ uar [a,b] then the expected number of group operations is 

(2 + o(l))Vb-a. 

We show matching upper and lower bounds, so the lead constants are sharp, which is rare 
among the analyses of algorithms based on Markov chains. Previously the first bound was known 
only by rough heuristic, while Pollard [6| gives a convincing but not completely rigorous argument 
for the second. Given the practical significance of Pollard's Kangaroo method for solving the 
discrete logarithm problem, we find it surprising that there has been no fully rigorous analysis of 
this algorithm, particularly since it has been 30 years since it was first proposed in [S]. 

Although our approach borrows a few concepts from the study the Rho algorithm in [3], such as 
the use of a second moment method to study the number of intersections, a significant complication 
in studying this algorithm is that when b — a <C \G\ the kangaroos will have proceeded only a small 
way around the cyclic group before the algorithm terminates. As such, mixing time is no longer a 
useful notion, and instead a notion of convergence is required which occurs long before the mixing 
time. We expect that the tools developed in this paper to avoid this problem will prove useful in 
examining other randomized algorithms. 

The paper proceeds as follows. In Section [2] we introduce the Kangaroo method. A general 
framework for analysing intersection of independent walks on the integers is constructed in Section 
02 This is followed by a detailed analysis for the Kangaroo method in Section HI The Appendix 
contains the proof of a technical lemma used in Section [3l 

2 Preliminaries 

We describe here the Kangaroo method, originally known as the Lambda method for catching 
Kangaroos. The Distinguished Points implementation of [1] is given, rather than the original 
implementation of [5], as the former is more efficient. 

Problem: Given g,h £ G, solve for x £ [a, b] with h = g x . 
Method: Pollard's Kangaroo method (with distinguished points). 
Preliminary Steps: 
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• Define a set D of "distinguished points" , with j^j = -7^= for some constant c. 

• Define a set of jump sizes S = {so, s\, . . . , Sd}- We consider powers of two, S = {2 k }i =0 , with 
d = log 2 Vb — a + log 2 log 2 Vb — a — 2 chosen so that elements of 5 average ^ b ~ a . 

• Finally, a hash function F : G —* S. 

The Algorithm: 

• Let X = S±k, Y = x, and d = 0. Observe that g Y ° = hg d °. 

• Recursively define X i+ i = Xj + F(g Xi ) and likewise = dj + F(hg di ). This implicitly 
defines = Y { + F(c/ yi ) = x + 

• If g Xi G D then store the pair (g Xi ,X{ — Xq) with an identifier T (for tame). Likewise if 
g Yi = hg di e D then store (g Yi ,di) with an identifier W (for wild). 

• Once some distinguished point has been stored with both identifiers T and W, say g x * = g Y i 
where (g Xi ,Xi — Xq) and (g Yj ,dj) were stored, then 

Xi = Yj = x + dj mod |G| x = — dj mod |G| 



The Xj walk is called the "tame kangaroo" because its position is known, whereas the position 
Yj of the "wild kangaroo" is to be determined by the algorithm. This was originally known as the 
Lambda method because the two walks are initially different, but once g Xi = g Yi then they proceed 
along the same route, forming a A shape. 

Theorem 11.11 makes rigorous the following commonly used rough heuristic: Suppose Xq > 
Yq. Run the tame kangaroo infinitely far. Since the kangaroos have an average step size x "~" 



2 ' 

one expects the wild kangaroo requires steps to reach Xq. Subsequently, at each step 

the probability that the wild kangaroo lands on a spot visited by the tame kangaroo is roughly 
p = -j= 1 , so the expected number of additional steps by the wild kangaroo until a collision is 

then around p~ l = "^ b ~ a . By symmetry the tame kangaroo also averaged p~ l steps. About ^ b ~ a 
additional steps are required until a distinguished point is reached. Since Xi and Y{ are incremented 
simultaneously the total number of steps taken is then 



1*0 -Pol „-i , Vb 
Vb^/2 1 



+ <(3 + 2c- 1 )Vb^ 



If Y = x £ uar [a, b] then £^=| = and the bound is (2 + 2c" 1 )^/6^. 

We make only two assumptions in our analysis. First, that the hash F : G — > S is a random 
function, i.e. if q G G then F(g) is equally likely to be any value in S, independent of all other 

F(q'). Second, that the distinguished points are well distributed with c > oo; either they 

are chosen uniformly at random, or if c = Q(d 2 log 2 d) then roughly constant spacing between points 
will suffice. The assumption on distinguished points can be dropped if we instead analyze Pollard's 
(slower) original algorithm, to which our methods also apply. Both assumptions are made in most 
discussions of the Kangaroo method [TJIlllS], and so are quite acceptable. 
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3 Uniform Intersection Time and a Collision Bound 



In order to understand our approach to bounding time until the kangaroos have visited a common 
location, which we call a collision, it will be helpful to consider a simplified version of the Kangaroo 
method. First, observe by the assumption about the hash F : G — > S that Xj and Yj are inde- 
pendent random walks at least until they collide, and so to bound time until this occurs it suffices 
to assume they are independent random walks even after they have collided. Second, these are 
random walks on Z/|G|Z, so if we drop the modular arithmetic and work on Z then the time until 
a collision can only be made worse. Third, since the walks proceed strictly in the positive direction 
on Z then in order to determine the number of hops the "tame kangaroo" (described by Xj) takes 
until it meets the "wild kangaroo" (i.e. Xi = Yj on Z), it suffices to run the wild kangaroo infinitely 
long and only after this have the tame kangaroo start hopping. 

With these simplifications the problem reduces to one about intersection of walks Xi and Yj, 
both proceeding in the positive direction on the integers, in which Yj proceeds an infinite number 
of steps and then X; L proceeds some N steps until 3j, Xn = Yj. Thus, rather than considering a 
specific probability Pr[Xi = Yj] it is better to look at Pr[3j, X; L = Yj]. By symmetry, the same 
approach will also bound the expected number of hops the wild kangaroo requires to reach a location 
the tame kangaroo visits. 

First however, because the walk does not proceed long enough to approach its stationary distri- 
bution (true on both Z/|G|Z and more obviously on Z), alternate notions resembling mixing time 
and a stationary distribution will be required. 

Definition 3.1. Consider a Markov chain P on Z which is non- decreasing, i.e. P(u,v) > only 
when v > u. Let Xi and Yj denote independent walks starting at states (Xo,lo) 6 C Z x Z, for 
some set of permitted initial states $7 D U ve z{(v, v)}. For fixed e G [0, 1], the uniform intersection 
time T(e) 6 N and uniform intersection probability U £ R+ are such that 



We do not attempt to show a general existence result for uniform intersection time and prob- 
ability, as our primary interest is in the Kangaroo method. Also, to avoid clutter we write T to 
denote T(e) in the remainder. 

A natural approach is to consider an appropriate random variable counting the number of 
intersections of the two walks. Towards this, let Sn denote the number of times the Xi walk 
intersects the Yj walk in the first N steps, i.e. 



The second moment method used will involve showing that Pi-fS^r > 0] is non-trivial for some 
N. Our collision bound will involve the quantity Bt, an upper bound on the expected number of 
collisions in the first T steps between two independent walks. To be precise, define: 



Vt > T(e) : (1 - e)U < Pr(3j, X % = Yj) < (1 + e)U . 



N 




i=l 



T 




Then the expected number of steps until a collision can be bounded as follows. 
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Theorem 3.2. Consider a non- decreasing Markov chain on Z, two independent walks with starting 
states (Xo,Yq) 6 f2, and uniform intersection time and probability T = T(e) and U respectively. 
Then 



1 - 2^/B^ 



T < E min{i > : 3j, Xi = YA < (1 - 4c)- 1 s/T + 



l + 2B T 



U 



U(l + e) 

If i?T> e « and U^ 1 S> T then these bounds show that 

Emin{i >0: 3j,X i = Y j }~^. 

It will prove easiest to study Sn by first considering the first and second moments of the number 
of intersections in steps T + 1 to N, i.e. 

iV 



N - 1 {3j:X l =Y ] } , 

i=T+l 

in terms of the uniform intersection time and probability: 
Lemma 3.3. Under the conditions of Theorem \3.ty, if N >T then 
(l-e)(N-T)U < E[S N ] < (l + e)(N-T)U, 
E[S%] < (l + e) 2 (iV -TfU 2 



1 + 



1 + 2B T 
(N - T)U 



This is a technical lemma and offers little insight into our proof, so it is left for the Appendix. 
We now upper and lower bound the probability of an intersection in the first N steps: 



Lemma 3.4. Under the conditions of Theorem \3.S\ if N >T then 



B T + (N- T)U(1 + e) > Pr[S N > 0] > (1 - 4e) 



1 + 



1 + 2B T 
(N - T)U 



Proof. Observe that Pr[5jy > 0] > Prf^Ar > 0], so for the lower bound it suffices to consider Sn- 
Recall the standard second moment bound: using Cauchy- Schwartz, we have that 

E[S N ] = E[S n 1 {Sn>0} ] < £[^]V2£[i {iSjv>0} ]i/2 
and hence Pr[c>Ar > 0] > E[Sn] 2 / E[Sjj] . By Lemma [3731 then, independent of starting point, 



Pr[S N > 0] > 



1 - e 
TTe 



1 + 



1 + 2B T 
(N-T)U 



n -l 



> (1 - 4e) 



1 + 



1 + 2B T 
(N - T)U 



n -l 



since 



l-e 
l+e 



> 1 - 4e, for e > 0. 



Now to upper bound Pt[5at > 0]. Since Sn € N then 

Pr[S N > 0] = E[1 Sn>0 ] < E[S N ] 
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The expectation E[Sn] satisfies 



N N 

E[S N ] = E^2l {3jtXi=Yj } = J2E[l {3jtXi=Yj }] 
i=i i=i 

T N 

= ^ Pr[3j, X, = !■] + £ Pr\3j,X i = Y j ] 

i=l i=T+l 

< B T + (N - T)U(l + e) . 



Proof of Theorem \3.2l First, we upper and lower bound Pr[SkN = 0] for every k > 1. 
For £>1, let 



iv 



{^3 :X (l-l)N+i= Y j} ' 



1=1 



so that sff = Sn- Thus 



Pr[5^ = 0] = P r [S N = 0}Pr[S 2 N = 0\S N = 0}---Pr[S kN = 0\S {k ^ 1)N = 0} 



H Pr[S$ = | S (e _ 1)N = 0] 



□ 



By taking Xq <— -X7g_;njy and Yq <- min{lj : ij > X^^^r}, we may bound: 



B T + (N- T)U(l + e) > 1 - Pr[S$ = | S ( *_ 1)JV = 0] > (1 - 4e) 



1 + 



1 + 2B T 
(N-T)U 



Hence 



l-(l-4e) 



1 + 



1 + 2B T 



(N - T)U 



> Pr[S kN = 0)>(1-B T -(N- T)U(1 + e)) k 



These upper and lower bounds will now be used to bound the collision time. 
First, the upper bound. 



Emm{i:S l >0} = l<j i=0 = 1 + Pr[# = 0] < >T Pr[S kN = 0]N 



i=0 

oo 



i=0 



k=0 



< NJ2 l-(l-4e) 



k=0 



1 + 



l + 2B T 



(N-T)U 



-V 



V ' V {N-T)UJ 



This is minimized when N = T + y ^—tj-^—, which gives the upper bound of the theorem. 



To show the lower bound, take 

oo oo 

Emm{i : Si>0} = Pr[Si = 0] > ^ Pr[S kN = 0}N 



i=0 k=l 

oo 

> 7Vj^(l-Br- (N-T)U(l + e)Y 
k=i 

N 



B T + (N - T)U(1 + e) 

If > 1 then the bound stated in the theorem is trivial, so assume Bt < 1- 
If — ^t) < TU(1 + e) then the maximum of the above bound is at N = T. In this case 
the bound is 

1 \ l-B T 



E^ { i:S i >0}>N { --l)> WT ^-T. 



When Bt(1 — Bt) > TU(1 + e) then the maximum is at N = jf^^, where the quantity 
7 = \JBt — TU(1 + e). In this case the bound is 

£min{! : S , > 0, > ^ ^ L > L_^-lL . 

□ 

To bound the value of Bt it will prove easier to consider those intersections that occur early in 
the Yj walk separately from those that occur later. 

Lemma 3.5. Let r >T be such that whenever (Xo, Yq) 6 fl then 

Pr[{X i }J =l C\{Y j } j>T ^$}< 1 . 

Then 

T 

B T <lT + 2 V(l + j) max P j (u, v) . 

— ' u.v 

J'=l 

Proof. Recall that 

When j > t then 

T 

^ Pr[3j > r : Xi = Yj] < T Pr[{JQ}f =1 n {YJ-} J>T + 0] < 7 T . 
i=i 

When j < r then 

£ Prpj < r : X, = Yj] < £ £ £ P*(X , tOP 5 ' (*>,«) 

i=l i=l jf=0 f 

r j 

< 2 max P J (w, x) max^^ P l (u, v) 

j=l i=0 ' v 

T 

= 2^(1 + j)maxP J '(w,i) . 

^ — ' «j,:r 
J'=l 
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The second inequality follows by letting j denote the larger of the two indices and i the smaller. 
The final equality is because Yl v P l {u,v) = 1- d 

4 Catching Kangaroos 

The collision results of the previous section will now be applied to the Kangaroo method. The first 
step in bounding collision time will be to bound the uniform intersection time and probability. This 
will be done by selecting some d of the first T steps of the Xj walk (for suitable i) , and using these 
to construct a uniformly random d-bit binary string which is independent of the specific step sizes 
taken on other steps. This implies that the walk is uniformly distributed over some interval 
of 2 d elements, and so the probability that some Yj = will be exactly the expected number of 
times the Yj walk visits this interval, divided by the interval size (i.e. 2 d ). 
Throughout we take 

Q = {(X , Y ) : X < Y < X + 2 d } . 
Lemma 4.1. If (X , Y ) G ft and i > T = 2{d + 1) 2 (1 + log 2 (d + 1)) then 



Pr(3j, Xi = Yj) 



2/Vb- 



3 3 

< -—— - ; 

log 2 Vb — a d 



i.e. when e = | then one may take T(e) = T as above and U = ^ b _ a - 

Proof. The tame kangaroo will be implemented by choosing k £ uar {0, 1, ... , d} and then flipping 
a coin to decide whether to increment by 2 k or 2 k+l (if k = d then increment by 2 d or 2°). We say 
generator 2 k has been chosen if value k was chosen, even though the step size taken may not be 2 k . 

Consider the tame kangaroo. For k G {0, 1, . . . , d — 1} let 5^ denote the step taken the first 
time generator 2 k is chosen, so that 5^ — 2 k e uar {0,2 fc }. Also, let T be the first time all of the 
generators have been chosen (including 2 d ). Define 5 = Ylt=o(.^k — 2 k ) e uar {0, 1, . . . , 2 d — 1} and 
let 2j denote the sum of all increments except those incorporated in a 5k, so that if i > T then 
Xi = X +li + 2 d - 1 + 5. 

Suppose i> T. Then 5 is independent of the value of Xi, and so 

Xi e uar [X +l t + 2 d -l,X +li + 2 d+1 - 1) . 

Observe that X + Zj + 2 d — 1 > X + 2 d — 1 >Y . Since the average non-zero step size for Yj is 
v ^ 2 ~" (recall d was chosen to guarantee this) then 

Pr(3j, Xi = Yj\i> T) 

E n [X +Ii + 2 d - 1,X + Xi + 2 d+1 - 1)| 



2 d 



> 



l2 d /(±Vb^)\ 
2 d 



> ^=-2- d = ^=[l- 



\Jb — a \Jb — a \ log 2 \Jb — a 

Similarly, an upper bound of ^ = + 2~ d follows by taking ceiling instead of floor. 

Next, consider T. By the Coupon Collector's problem E(T) = (d + 1)7^+1 where H n = 
YH>=i^~ l ls trie n "^h harmonic number. By Markov's Inequality Pr[T > 2(d + l)Hd + i] < 1/2 and 
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□ 



so if a = d + 1 then 

a 

Pr[T>a2(d + l)H d+l ] = [J Pr [T > £2(d + l)H d+1 \ T > (£ - l)2(d + l)H d+1 ] 

l=i 

< 2~ a = 2~ (d+1) . 

Since H n < Inn + 0.6 + ^, we get in turn Pr[T > T) < 2-^ d+1 \ To finish, 

Prpi, Xt = Yj] = (1 - Pr[T > T])Pr[3j, X i = Y j \T< T] 
+Pr[T > T] Pr[3j, J*Q = ^ | T > T] . 

Since all probabilities are in [0, 1], and < Pr[T > T] < 2"( d+1 ) then 

|Pr[3j, Xi = Yj] - Pr[3j, X i = Y j \T< T}\ < 2~^ . 



It remains only to upper bound Bx- This will be shown by breaking up the sum of Lemma 
into two parts. Let k = \/d + 1. When j < 2k then it will be shown that with high probability 
every step size taken was distinct, in which case the sum of the step sizes is a random (d + 1) bit 
binary string containing exactly j ones, i.e. uniform over possibilities. When j > 2k then 

with high probability at least k distinct step sizes have been chosen, in which case a random K-bit 
binary string is extracted as in the proof of Lemma 14.11 and used to show the maximum probability 
of a state is at most 2~ K . 

Lemma 4.2. IfT = 2(d + 1) 2 (1 + log 2 (d + 1)) then B T = o d {l) . 

Proof. This will be shown by applying Lemma 13.51 To bound P J (u, v) we set Xq = u and consider 
Xj for j G {1, 2, . . . , t}, where r is to be determined later. Recall that k = i/d + 1. 

First suppose 1 < j < 2k. Assume d > 2 so that j < d+1. Implement the kangaroo walk in 
the obvious way, i.e. choose k G {0, 1, . . . , d} and increment by 2 k . Let £ denote the event that all 
j increment sizes were distinct. Then 

pr[g] = (d+l)d...{d + 2-j) > U + 2-j V > i j(j - 1) 



(d+l)i ~ \ d + l J ~ d+1 

because (1 — x) n > 1 — nx if x G [0, 1] and n G N. Then 
maxP J (n, v) = max Pr[X ? - = v] 

V V 

= max Pr[£\Pr[Xj = v\£} + Pr[T]Pr[Xj = v \ £ } 



< l* 7dT K + ( 1 - Pf { £ })* 1 



< _^ + ^_il< 4 (rf + l)^/5 
~ d+1 d+1 ~ v ; 

If d = 1 then trivially P j (u,v) < 4(d + 1) _3/5 2.64. Then 

2k 

+ l)maxP j (u,v) < (l + 2K) 2 4(d + l)~ 3/5 = o d (l) . 

3=1 
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Before calculating the remaining terms in the sum, a value for r in Lemma 13.51 is needed. Note 
that trivially 

X T <X + T2 d . 
Let Ay be a random increment of the Y walk. Then 

2 d 1 l + log 2 (d + l) 



Pr 



Ay > 



d + 1 



d + l 

A Chernoff bound can be used here. If j > i + i P g (rf+i) ^ ne ex P ec ted number of steps of size at least 
^ is u = 2T(d + 1) so that E[Yj - X ] > E[Yj - Y ] > 2T2 d . With 5 = 1/2 then 

Pr[Yj < X + T2 d ] < e ~^ 2/2 < e -4(cZ+i) 3 (l+iog 2 (d+l))/8 < 2 _ ( d+1 ) . 

It thus suffices to take r = = 4(d + l) 4 , with 7 = 2"( d+1 ) and 7T = o d (l). 

Finally, suppose 2k < j < t. Implement the kangaroo walk as in the proof of Lemma 14.11 and 
likewise assume the same terminology. Let S denote the set of distinct generators that have been 
chosen excluding 2 d , so that |<S| < d, and observe that Y^kesi^k — 2 fe ) G uar {2^ s \ elements}, so that 
if Ij is the sum of all increments except those used the first time an element of S was chosen then 
Pr[Xj = v I S,Xj] < 2 _ I 5 I. It follows that Pr[Xj = v \ \S\] < 2^. Hence, if £ denotes the event 
that k or fewer distinct generators have been chosen, so that £ implies |<S| > k, then 

maxP j (n,u) < Pr[£] * 1 + Pr[£] — 

u,v 2 K 

~ ( k ) (d+l) * 1 + 1 * 2F 

< (d + 1) K (d + l)- 4 J'/5 + 2 - K 

< (d+l)~^ + 2 - K 

(l+j)m a xPi(u,v) < (1+r) 2 ((d+l)-l K + 2- K ) = o d (l) . 

u,v \ J 

□ 



It follows that 



E 

j'=2k+1 



We can now prove the main result of the paper. 

Proof of Theorem ] Note that the group elements can be pre-computed, so that each step 
of a kangaroo requires only a single group multiplication. 

As discussed in the heuristic argument of Section [21 an average of steps are needed to 

put the smaller of the starting states (e.g. Xq < Yq) within 2 d of the one that started ahead. If the 
Distinguished Points are randomly distributed then the heuristic for these points is again correct. 
If instead they are roughly constantly spaced and c = (d 2 log 2 d) then observe that in the proof of 
Lemma B~T1 it was established that after T = T(e) = 2(d + 1) 2 (1 + log 2 (d+ 1)) steps the kangaroos 
will be nearly uniformly random over some interval of length 2 d+l = \\/b — a log 2 y/b — a, so if 
the Distinguished Points are uniformly distributed and cover a ^ = fraction of vertices then an 

average of " v/6 ~ a such samples are needed, which amounts to T ^ b ~° = o(l) * \/b — a extra steps. 
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It remains to make rigorous the claim regarding p . In the remainder we may thus assume 
that \Xn — Yn\ < 2 d . Take e = : 3 ,, — ~ §. By Lemma 14,11 the uniform intersection time is 

1 u "I — log 2 Vb— a " 

T = T(e) = 2(d + 1) 2 (1 + log 2 (d + 1)) with uniform intersection probability U = ^j— , while by 

Lemma [4. 2 1 also Bt = o(l). The upper bound of Theorem 13.21 is then (i + o(l)) — o- The lower 
bound of Theorem 13.21 is then (i — o(l)) \/6 — a. □ 
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Appendix 

The proof of Lemma 13.31 was left to the Appendix: 
Proof. The expectation E[Sn] satisfies 

N N 

E[S N ] = E l3i,^=y,= Yl E[l Bj)Xi=x .]>(N-T)U(l-e). (1) 

i=T+l i=T+l 

The inequality is because E[l^j ,x t =x ■} = P r [3j, X; L = Xj}. The upper upper bound follows by 
taking (1 + e) in place of (1 — e). 
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Now for E[S%]. Note that 

(N N \ 

Y Y l3j,X i =Y :i l3t,X k =Yt 
i=T+l k=T+l J 
N N 

= E E Pr (^'' ^ : X * = Y ^ X * = X ^ ■ 

i=T+l k=T+l 

By symmetry it suffices to consider the case that k > i > T. Also, observe that if X; L = Yj then 
Xk = Yi is possible only if £ > j, because the X and Y walks proceed in the positive direction on 
the integer line. 

When k>i + T then Pr(3£, X h = Y st \X i = Yj) < U{1 + e) by definition of T, and so 

Pr(3j,£: X i = Y j ,X k = Y t ) 
= Pr(3j : X t = Yj) Pr(3£, X k = Y l \X i = Yj) 
< {l + e) 2 U 2 . 

When k<i + T then 

i+T 

Y Pr(3j,^: Xi = Yj, X k = Y e ) 
k=i+l 

T 

< Pr(3j : Xi = Yj) max Y Pr (^> X k = Y e \X = Y = u) 

k=l 

< B T U(l + e), 



since i> T. It follows that 



AT / j+T \ 

^] = E Pr (^' ■ x i = Y i)+ 2 Y Pr (^'' ^ : ^ = Y i> x >< = x ^ 

i=T+l V k=i+l / 

N N 

+ 2 E E Pr ^ ^ : ^ = Y i> Xk = x ^ 

i=T+l k=i+T+l 

< 2(1 + e)U(N - T)(l/2 + B T ) + 2(1 + - 2T)(N - 2T + 1) 



< {l + e) 2 U 2 {N -T) 



1 + 25 T 



(l + e)C/(iV-T)_ 



□ 
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